cyberlord92 Vulnerabilities and Affected Products
Vulnerabilities associated with Password Policy Manager | Password Manager.
Products
Clear product- Active Directory Integration / LDAP Integration4 vulnerabilities
- Miniorange OTP Verification with Firebase4 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)4 vulnerabilities
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)3 vulnerabilities
- Page and Post Restriction3 vulnerabilities
- Broken Link Checker | Finder2 vulnerabilities
- Employee Directory – Staff Directory and Listing2 vulnerabilities
- Integrate Dynamics 365 CRM2 vulnerabilities
- PowerBI Embed Reports2 vulnerabilities
- SAML Single Sign On – SSO Login2 vulnerabilities
- Web Application Firewall – website security2 vulnerabilities
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login1 vulnerability
- Login with YourMembership – YM SSO Login1 vulnerability
- login_using_wordpress_users1 vulnerability
- Malware Scanner1 vulnerability
- miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)1 vulnerability
- miniOrange OTP Login, Verification and SMS Notifications1 vulnerability
- miniOrange OTP Verification and SMS Notification for WooCommerce1 vulnerability
- Password Policy Manager | Password Manager1 vulnerability
- SAML IDP (Identity Provider) – Login with Website Users1 vulnerability
- Staff/Employee Business Directory for Active Directory1 vulnerability
- User Sync1 vulnerability
- Web3 – Crypto wallet Login & NFT token gating1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite All-Inclusive1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite Enterprise1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-11255MEDIUM | Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log OutThe Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange. CWE-862Oct 25, 2025 | CVSS4.3v3.1 | EPSS0.188% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |